Contributor Insights Rule Examples - Amazon CloudWatch

Contributor Insights Rule Examples

This section contains examples that illustrate use cases for Contributor Insights rules.

VPC Flow Logs: Byte Transfers by Source and Destination IP Address

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "LogGroupNames": [ "/aws/containerinsights/sample-cluster-name/flowlogs" ], "LogFormat": "CLF", "Fields": { "4": "srcaddr", "5": "dstaddr", "10": "bytes" }, "Contribution": { "Keys": [ "srcaddr", "dstaddr" ], "ValueOf": "bytes", "Filters": [] }, "AggregateOn": "Sum" }

VPC Flow Logs: Highest Number of HTTPS Requests

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "LogGroupNames": [ "/aws/containerinsights/sample-cluster-name/flowlogs" ], "LogFormat": "CLF", "Fields": { "5": "destination address", "7": "destination port", "9": "packet count" }, "Contribution": { "Keys": [ "destination address" ], "ValueOf": "packet count", "Filters": [ { "Match": "destination port", "EqualTo": 443 } ] }, "AggregateOn": "Sum" }

VPC Flow Logs: Rejected TCP Connections

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "LogGroupNames": [ "/aws/containerinsights/sample-cluster-name/flowlogs" ], "LogFormat": "CLF", "Fields": { "3": "interfaceID", "4": "sourceAddress", "8": "protocol", "13": "action" }, "Contribution": { "Keys": [ "interfaceID", "sourceAddress" ], "Filters": [ { "Match": "protocol", "EqualTo": 6 }, { "Match": "action", "In": [ "REJECT" ] } ] }, "AggregateOn": "Sum" }